OncologyLive® is the flagship publication of OncLive®. Each issue delivers expert insights and clinical oncology news and updates, which impact the day-to-day clinical practice of oncology professionals who work tirelessly to help improve patient outcomes.

	Traditionally, physicians have relied on textbooks, conferences, and, more recently, the Internet to keep abreast of the latest clinical data and support clinical decision-making. Now, in addition to these resources, physicians are turning to their smartphones. Currently, more than 60% of US physicians use a mobile device, and the number using smartphones is increasing as technology advances and platforms like the Apple iPhone, BlackBerry Storm, and Palm Pre continue to gain popularity.

	Smartphones are especially advantageous to physicians because they allow numerous tasks to be performed on one portable device, including calling, paging, scheduling, and accessing clinical resources, eliminating the need to wear a cumbersome utility belt that has numerous devices attached to it, such as a cell phone, personal digital assistant (PDA), and pager. The availability of reliable medical references on mobile technology platforms, such as PDAs and smartphones, has led to the emergence of tech-savvy practitioners who can stay informed and up-to-date without leaving their patients’ bedsides. This has revolutionized how medicine is practiced, as physicians are no longer tied to their offi ces to carry out functions that are essential to their practices and patients’ well-being.

	The availability of clinical reference products has proven to be paramount to physicians adopting new devices, such as smartphones. Mobile tools provide a solution to the information overload and administrative burden that many practitioners face, as clinical guidelines are constantly changing, many new drugs and indications are approved every year, and demands on time are becoming more pronounced. It is impossible to keep up with all the latest clinical developments and available literature, and, in general, oncologists face an even greater information burden because our patients tend to be older, have numerous medical comorbidities, and are often receiving multiple highly toxic drugs, all of which require special considerations. We are also often tasked with addressing the primary care needs of our patients, making access to the latest guidelines for treating a wide range of diseases and conditions a necessity. Oncologists must wear many hats in a field that is rapidly changing, and smartphones are proving invaluable in keeping us organized and up-to-date both personally and professionally.

	I am currently using a Palm Treo, but I am looking to move to the Apple iPhone or Palm Pre. These devices have all the functions of a traditional cell phone, including contact lists, calendars, and cameras. They also, of course, serve as a communication tool through calling and texting. The large memory of my device allows me to have all the tools and resources I want and need in one place. I can access pictures of my family, watch movies on the plane as I am heading to a conference, or read the news at leisure. I can also access the Internet and e-mail through my data plan. The multitude of features that smartphones provide can help you balance your personal life, while still allowing you to stay connected to your practice.

	Smartphones can be used in the office daily and are especially valuable when loaded with clinical references and tools designed to assist with drug lookups, symptom diagnoses, and prognoses. The resource I turn to most often is Epocrates Essentials, a clinical software solution that allows me to obtain concise and critical information while in the exam room. Epocrates and the other software

	on my Palm have saved me time, increased communication with my patients, and helped me to become more efficient.

Saving Time While Improving Patient Safety 

	Physicians can save a significant amount of time by using software solutions like Epocrates Essentials, which provide instant access to information on diseases and allow drug—drug interactions to be quickly checked and drug doses calculated without needing to leave the patient’s side. Many of the calculations that physicians frequently need to make can be performed expeditiously using mobile medical calculators and tools, such as MedMath.

	Oncologists often treat patients who are on several highly toxic medications, and interactions between these medications can cause serious complications. Oncology patients are also increasingly taking herbal supplements and over-the-counter medications in addition to their prescription drugs, further increasing the risk of adverse events. Whenever I see a patient for the first time, I use the Epocrates Interaction Checker to find out whether a patient’s symptoms are related to their medication or their illness. I can look up drugs with high toxicity levels and find those with fewer side effects before prescribing a new drug or recommending nonprescription medications and supplements, which lowers the chances of an adverse reaction.

	Mobile access to a patient’s health plan formulary is important when patients are on multiple medications and are facing high medication bills. With electronic formulary information on hand, I can select generic versions and provide drug costs to my patient as I write the prescription. In this downturned economy, it is a great relief for patients to have additional control over the cost of their treatments. Prescribing medications that are covered by my patient’s health plan also reduces the number of callbacks I receive from pharmacists. The time I save by not having to be on hold with pharmacists or looking for information can be spent more meaningfully with my patients.

	Some physicians have the misconception that patients will think they are uninformed if they reach for their smartphone to access clinical references and tools. I have found the opposite to be true. Seeing me use technology to confirm clinical decisions has provided reassurance to my patients and fostered more open communication with them by instilling confidence that they are receiving top-notch care. Patients find it most useful when I show them the information presented on my smartphone about a specific drug, such as a picture, possible interactions, or the dosage schedule.

	Smartphone users not only have access to downloaded software tools and programs, but also to the Internet, which infinitely expands the resources available to them. I can access the National Comprehensive Cancer Network (NCCN) guidelines from the 

 to help determine a treatment for a comprehensive chemotherapy 

. Other tools I use often, such as a cancer staging table or the Gail Breast Cancer Risk Calculator, are important to have at the point of care. For instance, the Gail Calculator on my smartphone allows me to calculate a woman’s risk of breast cancer instantaneously, which opens stronger lines of communication with my patient.

	A growing number of prognosis applications can be downloaded from the Websites of reputable institutions, such as the Memorial Sloan-Kettering Cancer Center 5-year Survival app, or can be increasingly found in apps stores, such as Apple’s App Store. When encountering a rare hematology disease, having access to a symptom checker and differential diagnosis at the point of care is essential. Although I do not use these tools daily, they are readily available on my Palm for when I need them.

	Mobile technology is easy to use and inexpensive, which has contributed to it becoming more commonplace in the medical community. Smartphones with clinical reference solutions are set to play a critical role within the health care system in reducing medical errors, saving clinicians time, and enhancing overall patient care. These are all critical for oncologists, who often treat patients with multiple highly toxic agents, are practicing in a field that is rapidly changing, and are set to face an ever-increasing cancer burden.

William Thomas Muuse, MD, FACP, is a medical oncologist at Falck Cancer Center, Elmira, NY. 

Articles

Traditionally, physicians have relied on textbooks, conferences, and, more recently, the Internet to keep abreast of the latest clinical data and support clinical decision-making

Smartphones Moving to the Front Line of Mobile Technology for Physicians

In 1890, Louise Brandeis and Samuel Warren published “The Right to Privacy” in the Harvard Law Review, indicating private individuals were being injured by the invasions of modern-day technology. Since tort law at that time contained no notion of privacy, this landmark paper introduced the concept of safeguarding individual privacy and laid the groundwork for doing so. Although today’s laws have evolved to protect the privacy of individuals, especially from being abused for nefarious purposes, we seem to have become an opt-in culture where subtle privacy intrusions are considered customary and are often tolerated. For instance, we routinely receive coupons for future purchases at stores based on our shopping patterns, which are tracked through our customer loyalty cards. It is also common to receive fliers and catalogs in the mail or via e-mail for services and merchants we have never done business with before. This is because many of the organizations we deal with sell our information to other entities, so there is no telling how many individuals have our personal information at any given time. While most people tolerate such intrusions, the majority draw the line when it comes to their financial and health records, taking measures to protect their privacy in those domains from any intrusions.

Despite the legal protection accorded to individual privacy, inadvertent or malicious violations are not uncommon and make for sensational media stories. The majority of privacy violations with malicious intent lead to identity theft, which generally results in financial fraud. Health care identity theft often leads to health care fraud, whereby an individual receives reimbursement for services that were never rendered or obtains health care services when he or she may be ineligible to obtain them using his or her own identity. The US Government Accountability Office estimates that 10% of health care expenditure reimbursed by Medicare is paid to fraudsters, including identity thieves and fraudulent health service providers.

In 1992, Congress passed the Healthcare Insurance Portability Act (HIPAA) to protect patients’ privacy, medical records, insurance activity, and other protected health information (PHI). HIPAA

rules required constant monitoring to ensure compliance by all entities that handled PHI, yet despite monitoring and compliance efforts by physicians, hospitals, clearing houses, and insurance companies, there have been numerous breaches of privacy, and these violations have not been aggressively pursued by the Department of Health and Human Services (HHS). The enforcement climate may change, however, after the passage of the American Recovery and Reinvestment Act of 2009 (ARRA), of which Title XIII of Division A and Title IV of Division B are referred to as the “Health Information Technology for Economic and Clinical Health Act,” or the “HITECH Act.” The ARRA provides incentives for adoption of electronic health records (EHRs), which would lead to an anticipated increase in the exchange of electronic PHI. The HITECH act widens the security and privacy provisions available under HIPAA and includes a number of measures designed to strengthen compliance by imposing substantial civil penalties on health care organization found responsible for those violations.

Even though most health care organizations have implemented HIPAA policies, there have been numerous incidents of medical data leaks that have lead to privacy violations. The Federal Trade Commission (FTC) has reported that a total of 19,428 individuals filed complaints specifically concerning medical identity theft from January 1, 1992 to April 12, 2006. This number is significant because the FTC doesn’t directly deal with health-related complaints; those are handled by HHS.

When health care organizations develop policies for HIPAA compliance and protection of privacy, it is important for them to have an understanding of who commits privacy crimes and how they are 

committed. In 1995, Louis Freeh, who was the director of the Federal Bureau of Investigation at the time, stated in a congressional hearing: “In South Florida and Southern California, we have seen cocaine dealers switch from drug dealing to health care fraud schemes. The reasons—the risks of being caught are less.” This statement highlights the need to screen employees carefully who will have access to PHI, as there are also numerous cases of insiders at health care organizations abusing their access to PHI and using it for financial gain. One recent case involved an office worker at a dental clinic in Ohio who used PHI to call in prescriptions at local pharmacies. A more costly information breach occurred when a front desk clerk at the Cleveland Clinic sold the medical information of more than 1100 patients, which was then used to file an estimated $7.1 million of fraudulent claims. Safeguarding PHI is crucial, but it may be absolutely imperative for oncology practices, because they provide complex and expensive care to the sickest patients. These patients do not need the added stress and burden of having their medical identity stolen and shouldn’t have their ability to receive treatments compromised.

Of course, organization insiders aren’t the only offenders. In 2006, the 

 reported the case of a Pennsylvania woman who found a lost wallet and used the insurance card inside to receive medical treatment at facilities in Pennsylvania and Ohio, racking up a total bill of $16,000. In 2007, 

 discussed the case of a wanted bank robber who used a stolen identity to obtain medical care totaling $41,888 because he could have been apprehended had he 

In some cases, security breaches occur without any malicious intent and result from organizations inadvertently releasing PHI, which is then obtained by outsiders to commit health care fraud. In such cases, although no ill will is intended by the organization or the employees involved in the breach, the breaches cause embarrassment for the organizations and subject them to potential legal action. It is difficult to identify what causes inadvertent breaches, but most occur in settings where there are ambiguous or no organizational policies for privacy and security, inadequate control mechanisms, and employees who are insufficiently trained to protect sensitive data; it can occur in large and small institutions alike. In 2007, the University of Pittsburg Medical Center posted the information of 80 patients, including their names and associated medical images, to the institution’s Website, and in 2008, Wuesthoff Medical Center in Florida had a similar breach, with the names, social security numbers, and personal medial information of more than 500 patients appearing on their Website. Because of the size of these data breaches, they were probably quickly discovered and corrected; however, not all data breaches are discovered immediately, and some may go unnoticed. An

experiment that searched for medical information on peer-to-peer networks showed that information on 20,000 patients, including their social security numbers, contact details, insurance information, and diagnosis codes, were being shared in a spreadsheet. This example is particularly alarming because most organizations don’t actively monitor peer-to-peer traffic, and even though this particular file was being shared without any ill intent, anyone with a malicious objective could have abused this information and caused tremendous damage. The same researchers also found that users of peer-to-peer networks were actively looking for files containing medical information. Their sampling of search queries showed specific search strings, such as “medical health record,” “doctor’s office medical exam,” “medical history,” and “medical billing.” This clearly demonstrates the increased sophistication of those involved in health care fraud, which should cause health care organizations to become more vigilant in safeguarding their PHI. 

The aforementioned examples illustrate various scenarios by which data breaches may occur and leave health care organizations vulnerable to prosecution for violation of HIPAA rules. The stringent and broad requirements of the HITECH Act make it imperative for all health care organizations entrusted with safeguarding PHI to reevaluate their security posture and audit their policies to ensure compliance with the security and privacy rules. A short primer on the HIPAA privacy and security rules and a brief description of the HITECH Act follow. 

The HIPAA Privacy Rule, which is contained in subpart E of CFR 164.500 and extends to 164.534, establishes the applicability of the standards to the covered entities and their usage and disclosure of PHI. The salient standards of the privacy rule are as follows: 

•A covered entity may not use or disclose PHI except for the permitted uses, which include treatment,   payment, disclosure to the individual, or other disclosures that are in compliance with the rules. 

•Use of de-identified PHI is permitted for clinical research and public health purposes, provided the     rules governing the dissemination of de-identified PHI are observed. 

•Disclosure of PHI to business associates is permitted only if written assurances can be obtained that they will appropriately safeguard the information. 

•The privacy rule sets forth standards for handling the PHI of deceased individuals, including dealing with personal representatives, confidential communications, and disclosure by whistleblowers. 

These standards clearly show the requirements that organizations entrusted with PHI are expected to follow. The privacy rule also sets forth the following standards: 

•CFR 164.504 establishes the standard for business contracts and states that if the covered entity         becomes aware of a material breach or violation of the contract, the covered entity is required to take corrective action, and if it is unsuccessful in remedying the situation, the contract must be terminated. The key point is that covered entities can’t simply ignore any known noncompliance activities of business associates.

•CFR 164.506 specifies the permitted uses and disclosures of PHI and describes the                               implementation specifications that delineate the permitted uses, which are outlined as treatment,         payment, or health care operations. 

•CFR 164.508 describes the uses and disclosures of PHI for which authorization is required. Broadly, this standard requires that authorizations must be obtained for all uses that are not covered in CFR 164.506. This section also specifi es that authorization is required for disclosure of psychotherapy notes and for the disclosure of PHI for marketing purposes, unless there is face-to-face communication between the covered entity and the individual, or a promotional gift of nominal value is provided by the covered entity. For instance, an authorization is not required, and it is not considered marketing, if a hospital provides a free package of formula and baby products to new mothers when they leave the hospital. Similarly, it is not considered marketing if an insurance agent sells a health insurance policy to an individual and then markets the policy based on responses received by the covered individual. If the covered entity is reimbursed by a third party, then it must be disclosed in the authorization. The standard for obtaining authorization where an individual has the right to refuse or agree with the disclosure of PHI is described in CFR 164.510 to 164.512.

•CFR 164.520 sets the standard for providing the notice of privacy practices for PHI, and these             standards appear to have been widely adopted by health care providers and organizations. 

•Just as the privacy rule standards aim to provide individuals with the right to refusal, CFR 164.522    also provides standards for the requests that can be made by an individual to a covered entity. The  health care provider or organization doesn’t have to agree to all of the individual’s requests, and  there are defined standards for circumstances where a covered entity may refuse an individual’s  requests for restricting the disclosure of PHI. CFR 164.522 allows an individual to prevent  disclosures of PHI to family members or other individuals close to  the patient. This creates a unique  situation for oncology practices because it is possible that an  individual, whose health condition  may be of interest to those close to him or her or even the general  public, may make specific  requests to restrict information on his or her general condition or treatment location. For instance, an  individual with terminal cancer may want to keep that information private if he or she is involved in a  legal dispute that may lead to an adverse decision if the litigants become aware of the individual’s  health condition or if they are a high-profile politician; or he or she may be the CEO of a publicly  traded company and wants to prevent competitors from using the CEO’s health information to affect  the outcomes of a political race or the stock price. One need only consider the case of Steve Jobs,  the CEO of Apple Inc, who took a 6-month medical leave to get treatment for his pancreatic cancer, during which time there were wild speculations about which treatments he was receiving and  where.

•CFR 164.524, 164.526, and 164.528 outline access of individuals to PHI, amendments of PHI, and  accounting of disclosures of PHI. The access of individuals to PHI is often governed by state laws;  thus, covered entities must consult the applicable state laws as well as the privacy rule standards. 

One of the most important sections for covered entities is CFR 164.530, which sets the standards for administrative requirements. These requirements include the following: 

•designation of a privacy officer for implementing the standards and resolution of complaints; 

In 1890, Louise Brandeis and Samuel Warren published Ãƒï¿½Ã‚Â¢ÃƒÂ¯Ã‚Â¿Ã‚Â½ÃƒÂ¯Ã‚Â¿Ã‚Â½The Right to PrivacyÃƒï¿½Ã‚Â¢ÃƒÂ¯Ã‚Â¿Ã‚Â½ÃƒÂ¯Ã‚Â¿Ã‚Â½ in the Harvard Law Review, indicating private individuals were being injured by the invasions of modern-day technology

July 2009 | Oncology Live®

Smartphones Moving to the Front Line of Mobile Technology for Physicians

Protecting privacy in the electronic era: HIPAA and HITECH mandates